[Paulo Lacerda (placerda)]

Deployment fixes

• Load azd deployment values through structured JSON in PowerShell and shell, preserving literal values and rejecting invalid metadata.
• Resolve role scopes from canonical KEY_VAULT_NAME and supported URI outputs while preserving explicit overrides and ambiguity rejection.

Separate governance decision

At the maintainer's explicit request, ADR-0020 and the quality contract replace mandatory independent exception approval and automatic blocking merely for registry updates with individual technical validation. Retain exact-source evidence, expiry, behavioral tests, protected evaluator integrity, read-only CI and fail-closed aggregation. Runtime implementation is Azure/agent-app-ui#144 at 02e3d0b; no gate or repository rules disabled. Recorded separately in commit c94d0b5.

Validation

• Deployment regressions: 23 tests and four subtests passed; root azd package passed.
• Definition/binding/provision negatives: 43 tests and 24 subtests passed.
• Both private custom root deploys and complete guest receipts passed at 0ab4665.
• Missing declared hosted runtime roles reconciled by existing evaluation Owner at exact resolved resource scopes; runner not elevated. Recheck found no missing grants.
• Private runtime checks verified ready digest-pinned Container response equal to live platform output/identity and active hosted version7 with expected project greeting through managed identity and private DNS.
• UI policy56 and full555 tests passed; candidate lint/type/architecture/exceptions zero findings. Remote CI and incorporation of the changed protected evaluator are not claimed complete.

Documentation

Sanitized Azure evidence recorded in quickstart. Azure/AI-Landing-Zones#149 head795d46b includes canonical vault and safe diagnostic operator guidance; strict MkDocs passed.

Limits

No release or merge performed. Custom deployment/runtime evidence does not close fresh one-command stock azd up, delegated-user OBO, grounded answer/citations, document authorization or full S1–S7. #695 remains open.